⚠️ DRAFT — NOT LEGAL ADVICE. This document was drafted as a starting point and MUST be reviewed, corrected and approved by a qualified solicitor / data protection specialist before use. It is likely incomplete and may be wrong in places.

rolo — Safeguarding & Children

Draft date: 2026-07-11 · Effective date: [EFFECTIVE DATE]

This notice explains, in plain English, how rolo tries to keep children safe. It is written for parents and carers, and it is honest about what rolo can and cannot do. It sits alongside our Privacy Policy and Terms of Service.

rolo is a supportive tool, not a safety service, and not an emergency service. If a child is in immediate danger, call 999. If you are worried about a child's safety, contact the right professional or helpline (for example the NSPCC on 0808 800 5000, or Childline on 0800 1111). Do not rely on rolo in an emergency.

1. Our promise: "watched over, never watched"

rolo is built on a simple idea. A child should be able to talk freely to a kind companion and always be safely watched over by a grown-up who loves them — without feeling spied on.

• A grown-up can always read the companion chats. The child is told, plainly and from the start, that a grown-up can always read their chats with the companion. This is a platform guarantee, not a hidden setting. There is no private, unreadable mode.
• Watched over, not watched. The grown-up is there to keep the child safe, not to hover over every word in the moment. rolo surfaces what matters through alerts, so a parent does not have to read everything constantly to stay close.
• Friend chats are the exception, and the child is told that too. Where a child messages a real friend, the grown-up is told how it feels, not what was said. Section 7 explains why, and what protects the child instead.

2. How the data is kept safe by design

• The child has no login and no password. Everything flows through the parent's account.
• rolo holds the child's identity; the companion platform (AIR) holds the friendship. rolo sends AIR the minimum — a first name, an age band, and a short brief — never the exact age and never the parent's identity.
• One child per device. A device is paired to one specific child by scanning a QR code from the parent's signed-in session. This is a deliberate safeguarding invariant: it stops devices being shared between children and keeps each child's world separate.
• Everything can be erased. Removing a child erases both sides — the rolo record and AIR's memory of the child — and records a purge receipt as proof it was done.

3. How alerts work

rolo watches for moments when a child may need their grown-up, and sends a same-day alert to the account owner and to any read-only observers.

• Quiet hours. You can set quiet hours so that ordinary, non-urgent alerts do not disturb the family at night or during agreed times.
• Urgent-safety override. If something looks like it needs a grown-up right away, an urgent-safety alert can override quiet hours so it is not held back. [LEGAL REVIEW NEEDED / SAFEGUARDING REVIEW NEEDED: define precisely what counts as "urgent safety", who decides (rolo, AIR, or a rule), and how reliably the override works.]

Alerts are an aid. They may not catch everything, and they are not a substitute for talking with your child and being present in their life.

4. Ending a chat for safety

If a conversation reaches a point where it is not safe or appropriate to continue, the companion may end or pause the chat. When this happens, the grown-up is informed through an alert.

[SAFEGUARDING REVIEW NEEDED: document exactly what triggers a chat being ended for safety, what the child sees when it happens, and how the child is supported in that moment so they do not feel punished or abandoned.]

5. Multiple grown-ups watching over one child

A family can have one owner (full control) and read-only observers (a second parent, grandparent or carer). Observers can read chats and receive alerts but cannot change anything. Inviting an observer means another trusted adult can see the child's chats. The owner is responsible for who they invite.

6. What we tell the child

rolo is designed to be honest with children in age-appropriate, autism-friendly language:

• that they are talking to a friendly companion, not a real person;
• that a grown-up can always read their chats with the companion;
• that in friend chats, their grown-up sees how it feels but not what they said — and that someone from the cast is watching over it and can step in;
• that they can stop at any time.

[SAFEGUARDING REVIEW NEEDED: have a child-safeguarding and autism specialist review the exact child-facing wording so it is clear, reassuring and not frightening. Pay particular attention to the friend-chat wording: a child must not come away believing friend chats are unmonitored, nor that a grown-up is reading over their shoulder. Both misunderstandings are harmful, in opposite directions.]

7. Messaging real friends

Older children can message real friends. It is off unless a grown-up turns it on, and each friendship needs both children's grown-ups to approve it before any message can be sent.

This is the one place where a grown-up cannot read. That is a deliberate inversion of the promise in section 1, and it deserves a straight explanation.

Why. A child who knows a parent reads every word of their friendships either stops using it, or stops being honest in it. Either way the protection we were trying to provide leaves with them. Autistic children in particular often have fewer places where a friendship can be practised safely, and a watched one is not practice.

What protects the child instead. A member of the cast — the same companion the child already knows — watches over every friend chat. It never joins in. Before a message is sent it can:

• let it through;
• gently coach the sender — "this might land harder than you mean it to" — and let them decide;
• hold it back, explain why, and help write something else.

The grown-up is told when something was held back, and receives a sense of how the friendship is going over time. Not the words.

Taking a message back. A child can take back a message they sent, and it disappears for their friend too. What they take back is removed from the chat, not from the safeguarding record — which nobody in the conversation, and no parent, can read or change. The same is true in the companion chat, with one difference the child is told at the moment they do it: a grown-up can still read it.

What is stored. Friend messages are held by AIR for 30 days, encrypted, then permanently deleted. They are kept so the safety analysis can see what a single message cannot: a tone hardening over weeks, the same unkindness rephrased, or several children targeting one child at once. Nobody — not you, not rolo — can read them; only the safeguarding analysis, and any emergency access is logged with a named person and a reason. The Privacy Policy section 5c states this precisely, including why "encrypted" here does not mean what it means in WhatsApp.

The honest limits. The companion is an AI and will miss things. It sees messages as they are sent, so it cannot know what happened at school, in another app, or in person. It is a good deal better than an unwatched chat, and it is not a guarantee. Keep talking to your child.

[SAFEGUARDING REVIEW NEEDED: this feature gives a child a communication channel their parent cannot read. That is defensible, and it is also exactly the shape of thing a safeguarding specialist should pressure-test. Specifically: (a) is the 30-day window plus emergency access the right balance, (b) what is the escalation path when the analysis detects grooming or bullying rather than ordinary unkindness, (c) how does this interact with open question 3 below — what if the risk is from the parent — given this is the one channel that parent cannot see, and (d) at what age is this appropriate at all?]

Open questions for a safeguarding specialist

These are the important questions this draft cannot answer. They need a qualified safeguarding professional (and legal input) before launch.

1. Escalation policy for serious disclosures. What should happen if a chat surfaces self-harm, suicidal thoughts, abuse, neglect, or exploitation? Who is notified, in what order, how fast, and what does the child see? What is the exact difference between "tell the parent" and "this needs more than the parent"?
2. Mandatory-reporting posture. Does rolo have, or should it adopt, any duty or policy to report concerns to external authorities (e.g. local authority children's services, the police)? What is rolo's stated position, and how does it interact with the parent being the account holder? [LEGAL REVIEW NEEDED: UK safeguarding-reporting law and best practice for a private service.]
3. What if the risk is from the parent or an invited observer? The oversight model assumes the watching adult is safe. Design a position for cases where the concern involves the account holder or an observer.
4. Staff access controls. Who inside rolo can see a child's data or chats, under what circumstances, with what authorisation and logging? What DBS/vetting applies to staff who may access children's data?
5. Reliability of safety detection. How reliable is the alert / urgent-override / end-chat logic, given it depends partly on AIR's AI? What are the false-negative and false-positive risks, and how are they communicated to parents honestly?
6. Human review and support. Is there any human in the loop for the most serious signals, or is it fully automated? Should there be?
7. Record-keeping. What safeguarding records must be kept, for how long, and how do they interact with the right to erasure and the purge receipt?
8. Alignment with the Children's Code and "Keeping Children Safe in Education" / statutory guidance, to the extent relevant to a consumer service.

This is a non-lawyer draft and not legal or safeguarding advice. It must be reviewed and approved by qualified specialists before use.